[FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
Created attachment 334260 [details] Patch
Attachment 334260 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Wrong number of spaces before statement. (expected: 24) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] Total errors found: 10 in 7 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 334444 [details] Patch
Attachment 334444 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Wrong number of spaces before statement. (expected: 24) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] Total errors found: 10 in 10 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 334592 [details] Patch
Attachment 334592 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Wrong number of spaces before statement. (expected: 24) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Wrong number of spaces before statement. (expected: 28) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161: Comma should be at the beginning of the line in a member initialization list. [whitespace/init] [4] Total errors found: 10 in 11 files If any of these errors are false positives, please file a bug against check-webkit-style.
Comment on attachment 334592 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review > Source/JavaScriptCore/ChangeLog:11 > + This is the last change for FTL to support all the types of DFG nodes. Except for CreateThis. I’ll change ths part later.
(In reply to Yusuke Suzuki from comment #7) > Comment on attachment 334592 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=334592&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + This is the last change for FTL to support all the types of DFG nodes. > > Except for CreateThis. I’ll change ths part later. FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in.
(In reply to Saam Barati from comment #8) > (In reply to Yusuke Suzuki from comment #7) > > Comment on attachment 334592 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=334592&action=review > > > > > Source/JavaScriptCore/ChangeLog:11 > > > + This is the last change for FTL to support all the types of DFG nodes. > > > > Except for CreateThis. I’ll change ths part later. > > FYI, adding CreateThis will lead to a performance regression, or at least it > did when I added it. I remember it ended up having some effects on ICs which > made certain GetByOffsets turn into GetByOd, which caused object allocation > sinking to not kick in. See: https://bugs.webkit.org/show_bug.cgi?id=164904
Comment on attachment 334592 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review r=me > Source/JavaScriptCore/dfg/DFGOperations.cpp:810 > +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value) Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object". > Source/JavaScriptCore/dfg/DFGOperations.cpp:826 > +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value) ditto > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084 > + m_jit.codeBlock()->isStrictMode() > + ? (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict) > + : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict), Was this doing the wrong thing before? > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274 > + LBasicBlock notHoleCase = m_out.newBlock(); nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300 > + index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)), Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
Comment on attachment 334592 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review >>>> Source/JavaScriptCore/ChangeLog:11 >>>> + This is the last change for FTL to support all the types of DFG nodes. >>> >>> Except for CreateThis. I’ll change ths part later. >> >> FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in. > > See: > https://bugs.webkit.org/show_bug.cgi?id=164904 Yeah >> Source/JavaScriptCore/dfg/DFGOperations.cpp:810 >> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value) > > Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object". Yeah, it would be JSObject* if the indexing type is NonArray. I've changed the name to `object`. >> Source/JavaScriptCore/dfg/DFGOperations.cpp:826 >> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value) > > ditto Fixed. >> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084 >> + : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict), > > Was this doing the wrong thing before? No. Basically, this was OK. But for consistency, I've introduced this. I described the detail in ChangeLog. >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274 >> + LBasicBlock notHoleCase = m_out.newBlock(); > > nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that OK, changed it to `doStoreCase`. >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300 >> + index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)), > > Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly? Sounds nice. Fixed.
Committed r229053: <https://trac.webkit.org/changeset/229053>
<rdar://problem/37932289>
Comment on attachment 334592 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review >>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300 >>> + index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)), >> >> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly? > > Sounds nice. Fixed. Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?
Comment on attachment 334592 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review >>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300 >>>> + index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)), >>> >>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly? >> >> Sounds nice. Fixed. > > Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT? Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and Butterfly_publicLength. https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp#L62-L63 So I think it is OK.
(In reply to Yusuke Suzuki from comment #15) > Comment on attachment 334592 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=334592&action=review > > >>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300 > >>>> + index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)), > >>> > >>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly? > >> > >> Sounds nice. Fixed. > > > > Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT? > > Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and > ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and > Butterfly_publicLength. > https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/ > FTLAbstractHeapRepository.cpp#L62-L63 > So I think it is OK. 👍🏽